Description
Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Google Agent Development Kit (ADK) for Python
Default version status: unaffected
1.19.0 to < 1.39.1affected2.0.0a1 to < 2.7.0affected
References
- https://github.com/google/adk-python/issues/5618 ↗
- https://github.com/google/adk-python/pull/5619 ↗
- https://github.com/google/adk-python/commit/f72f0db58c5c1f4e8b8d4f04b8c592c9e49cbe9e ↗
- https://github.com/google/adk-python/commit/c27d8688ed9ea619587ad96cbfd641c34dd7340c ↗
- https://github.com/google/adk-python/commit/0ae2bffdd2628af6c8643bc4fd40c2f49f0c6bd4 ↗
- https://github.com/google/adk-python/releases/tag/v1.39.1 ↗
- https://github.com/google/adk-python/releases/tag/v2.7.0 ↗